Guideline - An Overview of the FOIP Act and Record Keeping
Guidelines for AU Employees Performing Tutorial Functions

The Freedom of Information and Protection of Privacy (FOIP) Act,
R.S.A. 2000, c. F-25 was introduced in the Alberta Legislature in the spring
of 1994 and came into force for Alberta's post-secondary institutions on September
1, 1999.

Purposes of the FOIP Act

to allow the public, subject to limited and specific exceptions, a right
of access to records held by Athabasca University (AU)

to control the manner in which personal information may be collected from
individual(s), and to control the use of and disclosure of that information

to allow individuals, subject to limited and specific exceptions, the
right to have access to information about themselves held by AU

to allow individuals the right to request corrections to information about
themselves which is held by AU

to provide an independent review of decisions made by AU under the FOIP
Act.

Scope of the FOIP Act

the FOIP Act is in addition to and does not replace existing procedures
for access to information or records and should be viewed as a last resort
for gaining access to information or records

the FOIP Act does not affect access to records deposited in the archives
of AU that were unrestricted before the coming into force of the FOIP Act

the FOIP Act does not limit the information otherwise available by law
to a party to legal proceedings

the FOIP Act does not affect the power of any court or tribunal to compel
a witness to testify or to compel the production of document

What the FOIP Act Applies To

The FOIP Act applies to all records in the custody or under the control
of AU created both before and after the FOIP Act came into force except
for the records defined in section 4(1) of the FOIP Act.

Record:

means a record of information in any form and
includes notes, images, audiovisual recordings, x-rays, books, documents,
maps, drawings, photographs, letters, vouchers and papers and any other
information that is written, photographed, recorded or stored in any
manner, but does not include software or any mechanism that produces
records;

Custody:

means AU has possession of the record.

Control:

means AU has the authority to manage the record.

Each and every staff member creates, receives, uses, and maintains records
in conducting the business of AU. These records are considered to be AU
records and are subject to the FOIP Act. Your personal records or records
of another organization/business that you have in your custody are not subject
to the FOIP Act. It is recommended that you organize and store AU records
separately to avoid confusion, and to provide easy access to the university
records in the event of a request for the records in your possession.

Obtaining Access to Records

There are two methods for gaining access to records held by AU:

Non-FOIP requests or general inquiries for information. This method
will satisfy the information needs of most information seekers

FOIP requests. A method of seeking access to information that is
not otherwise available

The FOIP Act sets out the rules for access to records of AU and should
not replace existing procedures for access to information of AU that is
normally available to the public.

In the event of receiving a request to access the records in your custody
or under your control, follow established policies and procedures relating
to what information you may or may not release and what is the preferred
method of communicating the information. If the request is to access records
that are not normally routinely released or if you are unsure about releasing
the record, contact your supervisor, the centre you or the records are associated
with, or the Privacy and Policy Advisor.

If an applicant is not satisfied with the information AU makes available
through routine disclosure processes he or she may make a request for the
information under the FOIP Act. The FOIP Act requires the request to be
written. Oral requests may be made when the applicant's ability to read
or write in English is limited, or a physical disability or condition impairs
the applicant's ability to make a written request. The applicant may either
ask for a copy of the record or to examine the record.

Sometimes only part of the record is accessible because of the exceptions
to disclosure under the FOIP Act. As much of the record must be released,
as long as the disclosed portions of the record can be reasonably severed
from the excepted portions.

An applicant may request to have the request under FOIP continue for a
period of up to two years.

A FOIP request must be responded to within thirty calendar days unless
the time limit has been extended or the request transferred to a more appropriate
public body for response. An applicant must be told whether or not access
will be given and if access will be given, when and how it will be given.
If access is refused, the applicant must be given reasons for the refusal
as well as the name and address of a person who can answer questions about
the refusal, and that they may request a review of the decision by the Information
and Privacy Commissioner.

Exceptions to Disclosure

The FOIP Act recognizes that an absolute rule of openness would impair
the ability of AU to discharge its responsibilities effectively. This is
reflected in the FOIP Act by very specific and limited exceptions. There
are exceptions that set out when a record "must not" be released, and there
are exceptions that set out when a record "may not" be disclosed.

Most of the "may not" disclosure exceptions are based on a harms test.
The harms test is based on a determination of whether the disclosure of
all or part of a record could reasonably be expected to have a detrimental
effect on a particular public or private interest.

The FOIP Act sets out the rules that must be considered when determining
if a disclosure of personal information constitutes an unreasonable invasion
of a third party's personal privacy.

Fees

The FOIP Act and Regulation allows AU to charges fees for certain services
when responding to a FOIP request.

Rights of Third Party

If a FOIP request involves records containing personal or commercial information
about a third party, the third party must be notified and provided with
a copy of the record that is being considered for disclosure. The third
party has 20 days to respond. The applicant must be informed that third
party interests may be affected.

Public Interest Override

The FOIP Act includes a public interest provision that obligates AU, whether
or not a request is made, to disclose information about a risk of significant
harm to the environment or to the health and safety of the public or to
other matters clearly in the public interest.

Protection of Privacy

The FOIP Act establishes conditions and obligations that AU must meet in
protecting the privacy of individuals whose personal information is in its
custody or under its control.

Personal information means recorded information about an identifiable individual,
including:

the individual's name, home or business address or home or business
telephone number

the individual's race, national or ethnic origin, colour or religious
or political beliefs or associations

the individual's age, sex, marital status or family status

an identifying number, symbol or other particular assigned to the
individual

information about the individual's health and health care history,
including information about a physical or mental disability

information about the individual's educational, financial, employment
or criminal history, including criminal records where a pardon has been
given

anyone else's opinions about the individual

the individual's personal views or opinions, except if they are about
someone else

Collection of Personal Information

Personal information cannot be collected by AU from an individual unless
it is:

expressly authorized by or under an Act of Alberta or Canada

for the purposes of law enforcement, or

it is directly related to and is necessary for an operating program
or activity of AU

Generally, personal information must be collected directly from the individual
the information is about, unless other legislation authorizes the collection,
or it is necessary for an operating program or activity of AU.

When information is collected directly from the individual, the individual
must be told the purpose for which the information is collected, the specific
legal authority for the collection, and the title, business address and
phone number of an employee who can answer the individual's questions about
the collection.

AU will only collect the personal information that is necessary for an
operating program or activity. The collection of personal information will
be directly from the individual that the personal information is about unless
the individual has consented to indirect collection or the indirect collection
is possible under section 34 of the FOIP Act.

When personal information is collected from an individual, that individual
must be informed of the purpose for the collection of personal information.
That personal information may only be used for the purposes indicated when
it was collected or for purposes that are consistent with the original reason
it was collected. If you need to or want to use the personal information
for another purpose that is not consistent with the original reason, then
you must obtain the consent of the student to do so.

The notes or comments you record about a student are considered to be the
personal information of that student and the student has the right to request
access to the notes or comments. Create documentation that contains personal
information in a manner that enables release or reasonable severing in an
event of a request to access the record. An example would be to separate
the comments of more than one student in one memorandum into separate paragraphs
or better yet into separate memorandums.

When an individual's personal information is used by AU to make a decision
that directly affects the individual, AU must make every reasonable effort
to ensure that the information is accurate and complete, and retain the
personal information for at least one year after using it so that the individual
has a reasonable opportunity to obtain access to it.

An individual has the right of access to his or her own personal information
and to request a correction of information that the individual believes
may contain an error or omission. AU must either make the correction or
make note of the request for correction on the data subject file, and notify
the individual within 30 days of the action taken.

Use of Personal Information

AU may use personal information only for the purpose for which it was collected
or compiled or for a use consistent with that purpose, for another purpose
with the consent of the individual, or for purposes allowed under the disclosure
section of the FOIP Act.

Disclosure of Personal Information

The FOIP Act sets out specific rules about disclosure of personal information.
There are limitations on third parties obtaining access to the personal
information of another individual, what AU may disclose without a FOIP access
request, and what may not be released to an individual that the personal
information is about.

The common disclosures include: upon the consent or request of the student,
to other staff to enable them to fulfill their responsibilities, to departments
to provide their services, and to provincial and federal governments as
directed by other legislation. Disclosure to another staff member or department
is limited to personal information that is required for them to fulfill
their responsibilities.

Information and Privacy Commissioner

An applicant has a right to an independent review of decisions made by
AU. The FOIP Act establishes an Information and Privacy Commissioner to
monitor compliance with its legislative provisions by public bodies.

Offences

A person must not willfully collect, use or disclose personal information
in violation of the FOIP Act; make a false statement to, or mislead or attempt
to mislead, the Commission or another person in the performance of the duties,
powers or functions of the Commissioner or other person under the FOIP Act;
obstruct the Commissioner or another person in the performance of the duties,
powers or functions of the Commissioner or other person under the FOIP Act;
fail to comply with an order made by the Commissioner; or destroy any records
subject to the FOIP Act with the intent to evade a request for access to
the records.

A person who is guilty of an offence is liable to a fine of not more than
$10,000.

An individual who willfully discloses personal information pursuant to a
subpoena, warrant or order issued or made by a court, person or body having
no jurisdiction in Alberta to compel the production of information is guilty
of an offence and liable to a fine of not less than $2000 and not more than
$10,000. In the case of a corporation, the fines are substantially increased
- not less than $200,000 and not more than $500,000.

Managing Records

You are responsible for maintaining AU records in your custody and under
your control according to AU policies, procedures, retention and disposition
schedules. If you have any questions regarding these issues, contact the
centre you are associated with regarding the records for that program or
activity, the department that the records are associated with, the Office
of the Registrar regarding student records as the Office of the Registrar
maintains the official student record, or the Records and Information Coordinator.

Upon termination of employment with AU, the records in your possession
are considered to be AU records and must be dealt with according to AU policies
and procedures. The most common procedure would be to dispose of all transitory
records and forward all other records to the centre you were associated
with.

Duplicate copies of certain records may be created and retained by staff,
departments and centres for the purpose of easy access to information about
a student or his/her activity relating to a particular course or program.
These types of records are considered to be transitory records and once
the records no longer have any value or use, they can be destroyed.

Records considered to be transitory records:

announcement of conference

announcement of new staff member

email from student confirming they received the marked assignment

email to student stating the assignment was placed in the mail today

email to staff member requesting a form be sent to a particular student

If the records you have are only a copy and considered to be transitory,
but you have made notes on the document, you will need to determine if the
notes on the document have value and what that value is. You may have to
retain the copy as an original.

The most common types of records relating to a student that employees completing
tutorial functions may receive, create and maintain include tutor marked
exercises, student profiles, emails, correspondence, notes, assignments,
contact logs, and mail returned labeled address unknown.

Some of the records will be considered the original because no other copies
exist or are maintained by AU. These records may include:

copies of correspondence between a tutor and a student

emails between a tutor and student

copies of correspondence sent to another individual or institution
upon the request of the student such as a reference letter

handwritten notes made by a tutor during a conversion with a student
or about a student

completed assignments not returned to a student or sent to the Centre

Records considered an original record should be retained according to a
centre's or department's retention and disposition schedules. Contact the
appropriate centre or department for more information about the records
if in doubt. Schedule A of the Student Confidentiality Policy of the Office
of the Registrar lists the retention and disposition schedules for student
records received and maintained by that office. The policy and schedule
are available from the online
policy manual.

Records that are used to make a decision about an individual must be retained
for one year from the date the records were last used to comply with the
FOIP Act. If copies of the record exist, the copies may be disposed accordingly,
as the "original" will be maintained for the required period by the department
having custody of the original record.

Some records will be copies with the original being maintained by the centre
the tutor is associated with or a department of AU. The records may include
student profiles, completed tutor marked exercises, correspondence or email
from an AU centre or department that a tutor was copied on, or class lists.
These records should be retained as required and then disposed of accordingly.

Examples of retention and disposition periods for some records:

Record Type

Retention Period

Disposition

Assignments (original returned to student and a copy retained by tutor)

If the copy is retained only for the purpose of reviewing the assignment with the student or for an appeal process, then the assignment can be destroyed after the review or appeal period is completed.

If the copy is retained for a longer period of time then it should be retained for at least one year from the date the record was used.

Shredding

Assignments not returned to the student as in the case of received assignments with no identifying information (name, address, ID number)

One year from the date the record was used.

Shredding

Exams (original returned to AU and a copy retained by tutor)

If the copy is retained only for the purpose of reviewing the exam with the student or for an appeal process, then the exam can be destroyed after the review is completed.

If the copy is retained for a longer period of time then it should be retained for at least one year from the date the record was used.

Shredding

TMEs (copy retained by tutor)

As required if a copy was forwarded to the Centre or for one year if no copy was forwarded to the Centre.

Shredding

TMEs (copy retained by Centre)

One year.

Shredding

Emails about university social activities

As required. These would be considered to be a transitory record.

Deletion

Emails from and to a student that relate to the course and provide direction or decision

If the information is transferred to the student database or a log record then the email may be deleted. If the information is not recorded elsewhere then the email (paper or electronic) must be retained for one year from the date the record was used.

Deletion

Student profiles (copy provided to tutor)

As required. Usually only for the course contract period.

Shredding

Correspondence - reference letters written by tutor upon request from a student

One year from the date the record was used.

Shredding

Correspondence - that provides direction or decision

If the information is transferred to the student database or a log record then the correspondence may be destroyed. If the information is not recorded elsewhere then the correspondence must be retained for one year from the date the record was used.

Shredding

Notes about the student

One year from the date the record was used.

Shredding

Class lists

As required.

Shredding

Disposition of records that contain personal information should be shredded. If you do not own a shredder, return the records to Tutorial Services or Learning Centres for shredding. Clearly label the package as records for shredding.